Skip to content

id: research: permission-prompt precedents — Play Store, Android/iOS runtime permissions, OAuth scopes, extension permissions, TCC/portals #5961

Open

Description

@dezren39

Part of the worlds design program: #5955. Supports the permission-UX design (statements S19–S23 of the 2026-11-04 brief); filed as its own research per Drew's rule that sub-parts with a lot of prior art get dedicated documentation even when not needed for V1.

Task

Survey how existing platforms present and remember capability grants, and extract what works and what users actually understand:

  • Google Play permission declarations and runtime permission groups (the brief's named model).
  • Android runtime permissions: ask-on-first-use, per-permission memory, "ask every time," permission auto-reset for unused apps.
  • iOS prompts and privacy nutrition labels.
  • Browser extension permissions (Chrome/Firefox): install-time vs runtime host permissions, optional permissions.
  • OAuth scopes: blanket vs incremental authorization, scope creep complaints.
  • OS sandbox prompts: macOS TCC, Flatpak portals — per-resource, per-app remembered grants.
  • Failure literature: permission fatigue, blanket-accept rates, why install-time-only lists failed on Android and were replaced.

Deliverable

A research doc: per-system summary (what's shown, when, what's remembered, revocation), a comparison table, and a shortlist of patterns that fit a two-sided (client + server admin) grant model — feeding the permission-UX design child of #5955.

Done looks like

Doc landed and linked from the permission-UX design issue; every pattern the design adopts (or rejects) cites this survey.

Activity

  1. added
    priority/lowNice to have; do when convenient
    app/idPackage/app: id (pkgs/ or apps/ in this repo)
    kind/designA design proposal (design-architect): multi-step, phased, decision-bearing
    on Nov 5, 2026
  2. developing-today commented on Nov 5, 2026

    @developing-today
    Contributor
  3. added
    queue/queuedHas a queued task in the Supabase agent queue
    task/triageQueue packet kind: verify, reproduce, and route this item
    queue/parkedQueue task is parked (waiting on CI, time, or an event)
    status/parkedDeliberately paused with a recorded resume condition
    work/assignedQueue worker lifecycle state
    and removed
    queue/queuedHas a queued task in the Supabase agent queue
    on Nov 5, 2026
  4. dezren39 commented on Nov 5, 2026

    @dezren39
    MemberAuthor

    🤖 Agent note · handed off

  5. dezren39 commented on Nov 5, 2026

    @dezren39
    MemberAuthor

    🤖 Agent note · handed off

  6. added
    queue/claimedQueue worker lifecycle state
    and removed
    status/parkedDeliberately paused with a recorded resume condition
    queue/parkedQueue task is parked (waiting on CI, time, or an event)
    queue/claimedQueue worker lifecycle state
    work/assignedQueue worker lifecycle state
    on Nov 5, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

app/idPackage/app: id (pkgs/ or apps/ in this repo)kind/designA design proposal (design-architect): multi-step, phased, decision-bearingpriority/lowNice to have; do when convenienttask/triageQueue packet kind: verify, reproduce, and route this item

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions